<!DOCTYPE html>
<html lang="en">
  <head>
    <link rel="stylesheet" type="text/css" href="/css/style.css?v=18" />
    <link rel="stylesheet" type="text/css" href="/css/fontello.css?v=2" />
    <link rel="stylesheet" type="text/css" href="/css/themes/nitter.css" />
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
    <link rel="manifest" href="/site.webmanifest" />
    <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#ff6c60" />
    <link rel="search" type="application/opensearchdescription+xml" title="nitter" href="https://nitter.net/opensearch" />
    <link rel="canonical" href="https://twitter.com/ESETresearch/status/1410864752948043778" />
    <title>ESET research (@ESETresearch): &quot;#ESETresearch discovered inconspicuous Linux samples written in C++ which serve as configurable modular backdoors. They are referred to as StageClient throughout the code @HrckaVladislav 1&#x2F;8&quot; | nitter</title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta name="theme-color" content="#1F1F1F" />
    <meta property="og:type" content="photo" />
    <meta property="og:title" content="ESET research (@ESETresearch)" />
    <meta property="og:description" content="#ESETresearch discovered inconspicuous Linux samples written in C++ which serve as configurable modular backdoors. They are referred to as StageClient throughout the code @HrckaVladislav 1/8" />
    <meta property="og:site_name" content="Nitter" />
    <meta property="og:locale" content="en_US" />
    <link rel="preload" type="image/png" href="/pic/media%2FE5RjTOGX0AEUyRU.png%3Fname%3Dsmall" as="image" />
    <meta property="og:image" content="https://nitter.net/pic/media%2FE5RjTOGX0AEUyRU.png" />
    <meta property="twitter:image:src" content="https://nitter.net/pic/media%2FE5RjTOGX0AEUyRU.png" />
    <meta property="twitter:card" content="summary_large_image" />
    <link rel="preload" type="font/woff2" as="font" href="/fonts/fontello.woff2?21002321" crossorigin="anonymous" />
  </head>
  <body>
    <nav><div class="inner-nav">
        <div class="nav-item"><a class="site-name" href="/">nitter</a></div>
        <a href="/"><img class="site-logo" src="/logo.png" alt="Logo" /></a>
        <div class="nav-item right">
          <div class="icon-container"><a class="icon-search" title="Search" href="/search"></a></div>
          <div class="icon-container"><a class="icon-bird" title="Open in Twitter" href="https://twitter.com/ESETresearch/status/1410864752948043778"></a></div>
          <a href="https://liberapay.com/zedeus"><svg class="lp" viewBox="0 0 40.6 52.3">
  <g transform="matrix(0.83,0,0,0.83,-158,-261)">
    <path d="m202.5,366c-3.1 0-5.5-0.4-7.3-1.2-1.8-0.8-3-1.9-3.8-3.3-0.8-1.4-1.1-3-1.1-4.8 0-1.8 0.3-3.7 0.8-5.8l8.3-34.8 10.2-1.6-9.1 37.8c-0.2 0.8-0.3 1.5-0.3 2.2 0 0.7 0.1 1.2 0.4 1.7 0.3 0.5 0.7 0.9 1.3 1.2 0.6 0.3 1.5 0.5 2.7 0.6l-2 8.1"/>
    <path d="m239.2 344.3c0 3.2-0.5 6.1-1.6 8.8-1 2.6-2.5 4.9-4.4 6.9-1.9 1.9-4.1 3.4-6.7 4.5-2.6 1.1-5.4 1.6-8.5 1.6-1.5 0-3-0.1-4.5-0.4l-3 11.9h-9.7l10.9-45.4c1.7-0.5 3.7-1 6-1.4 2.3-0.4 4.7-0.6 7.3-0.6 2.4 0 4.6 0.4 6.3 1.1 1.8 0.7 3.2 1.8 4.4 3 1.1 1.3 2 2.8 2.5 4.5 0.5 1.7 0.8 3.6 0.8 5.5m-23.8 13.4c0.7 0.2 1.7 0.3 2.8 0.3 1.7 0 3.3-0.3 4.7-1 1.4-0.6 2.6-1.5 3.6-2.7 1-1.1 1.7-2.5 2.3-4.1 0.5-1.6 0.8-3.4 0.8-5.3 0-1.9-0.4-3.5-1.2-4.8-0.8-1.3-2.3-2-4.3-2-1.4 0-2.7 0.1-3.9 0.4l-4.6 19.1"/>
  </g>
</svg>
</a>
          <div class="icon-container"><a class="icon-info" title="About" href="/about"></a></div>
          <div class="icon-container"><a class="icon-cog" title="Preferences" href="/settings?referer=%2FESETresearch%2Fstatus%2F1410864752948043778%23m"></a></div>
        </div>
      </div></nav>
    <div class="container"><div class="conversation">
        <div class="main-thread">
          <div id="m" class="main-tweet"><div class="timeline-item thread thread-line"><div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ESETresearch"><img class="avatar round" src="/pic/profile_images%2F1244546916106612736%2FsvU0TBgH_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ESETresearch" title="ESET research">ESET research</a>
                        <a class="username" href="/ESETresearch" title="@ESETresearch">@ESETresearch</a>
                      </div>
                      <span class="tweet-date"><a href="/ESETresearch/status/1410864752948043778#m" title="Jul 2, 2021 · 7:35 AM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto"><a href="/search?q=%23ESETresearch">#ESETresearch</a> discovered inconspicuous Linux samples written in C++ which serve as configurable modular backdoors. They are referred to as StageClient throughout the code <a href="/HrckaVladislav" title="Vladislav Hrcka">@HrckaVladislav</a> 1/8</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/media%2FE5RjTOGX0AEUyRU.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FE5RjTOGX0AEUyRU.png%3Fname%3Dsmall" alt="" /></a></div></div></div>
                <p class="tweet-published">Jul 2, 2021 · 7:35 AM UTC</p>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 3</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 52</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 2</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 112</div></span>
                </div>
              </div></div></div>
          <div class="after-tweet thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/ESETresearch/status/1410864761886195712#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ESETresearch"><img class="avatar round" src="/pic/profile_images%2F1244546916106612736%2FsvU0TBgH_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ESETresearch" title="ESET research">ESET research</a>
                        <a class="username" href="/ESETresearch" title="@ESETresearch">@ESETresearch</a>
                      </div>
                      <span class="tweet-date"><a href="/ESETresearch/status/1410864761886195712#m" title="Jul 2, 2021 · 7:35 AM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Based on significant overlap, for example in structure of configs, we concluded that the samples belong to the same threat actor as Specter, described by <a href="/360Netlab" title="360 Netlab">@360Netlab</a> last year  <a href="https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/">blog.netlab.360.com/ghost-in…</a> 2/8</div>
                <div class="attachments"><div class="gallery-row" style="">
                    <div class="attachment image"><a class="still-image" href="/pic/media%2FE5RjxwBXIAMrS0G.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FE5RjxwBXIAMrS0G.png%3Fname%3Dsmall" alt="" /></a></div>
                    <div class="attachment image"><a class="still-image" href="/pic/media%2FE5RkCBWXoAYZILd.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FE5RkCBWXoAYZILd.png%3Fname%3Dsmall" alt="" /></a></div>
                  </div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 6</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/ESETresearch/status/1410864765551919104#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ESETresearch"><img class="avatar round" src="/pic/profile_images%2F1244546916106612736%2FsvU0TBgH_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ESETresearch" title="ESET research">ESET research</a>
                        <a class="username" href="/ESETresearch" title="@ESETresearch">@ESETresearch</a>
                      </div>
                      <span class="tweet-date"><a href="/ESETresearch/status/1410864765551919104#m" title="Jul 2, 2021 · 7:35 AM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">The authors introduced several changes and we’re going to describe the most significant ones. In the first place, the authors switched from the C language to C++. An option to exchange messages over HTTP was added among other minor modifications of the network protocol 3/8</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/media%2FE5RkTwzWEAA0mmb.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FE5RkTwzWEAA0mmb.png%3Fname%3Dsmall" alt="" /></a></div></div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 4</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/ESETresearch/status/1410864767850397696#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ESETresearch"><img class="avatar round" src="/pic/profile_images%2F1244546916106612736%2FsvU0TBgH_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ESETresearch" title="ESET research">ESET research</a>
                        <a class="username" href="/ESETresearch" title="@ESETresearch">@ESETresearch</a>
                      </div>
                      <span class="tweet-date"><a href="/ESETresearch/status/1410864767850397696#m" title="Jul 2, 2021 · 7:35 AM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Downloadable plug-ins were replaced with precompiled modules which fulfill the same purpose, a number of new commands and two modules TaskSchedulerMod and SysInfoMgr were added 4/8</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 5</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/ESETresearch/status/1410864771663118337#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ESETresearch"><img class="avatar round" src="/pic/profile_images%2F1244546916106612736%2FsvU0TBgH_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ESETresearch" title="ESET research">ESET research</a>
                        <a class="username" href="/ESETresearch" title="@ESETresearch">@ESETresearch</a>
                      </div>
                      <span class="tweet-date"><a href="/ESETresearch/status/1410864771663118337#m" title="Jul 2, 2021 · 7:35 AM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">TaskSchedulerMod operates as a built-in cron utility. Its cron table is stored in-memory; the jobs are received over the network and executed as shell commands 5/8</div>
                <div class="attachments"><div class="gallery-row" style="">
                    <div class="attachment image"><a class="still-image" href="/pic/media%2FE5RlQ3xWYAM5b4f.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FE5RlQ3xWYAM5b4f.png%3Fname%3Dsmall" alt="" /></a></div>
                    <div class="attachment image"><a class="still-image" href="/pic/media%2FE5Rlex3XIAI9yVq.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FE5Rlex3XIAI9yVq.png%3Fname%3Dsmall" alt="" /></a></div>
                  </div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 5</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/ESETresearch/status/1410864775341514756#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ESETresearch"><img class="avatar round" src="/pic/profile_images%2F1244546916106612736%2FsvU0TBgH_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ESETresearch" title="ESET research">ESET research</a>
                        <a class="username" href="/ESETresearch" title="@ESETresearch">@ESETresearch</a>
                      </div>
                      <span class="tweet-date"><a href="/ESETresearch/status/1410864775341514756#m" title="Jul 2, 2021 · 7:35 AM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">SysInfoMgr provides information about the underlying system such as list of installed packages and hardware details 6/8</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/media%2FE5RlBRdWQAURHSE.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FE5RlBRdWQAURHSE.png%3Fname%3Dsmall" alt="" /></a></div></div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 4</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/ESETresearch/status/1410864777409306631#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ESETresearch"><img class="avatar round" src="/pic/profile_images%2F1244546916106612736%2FsvU0TBgH_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ESETresearch" title="ESET research">ESET research</a>
                        <a class="username" href="/ESETresearch" title="@ESETresearch">@ESETresearch</a>
                      </div>
                      <span class="tweet-date"><a href="/ESETresearch/status/1410864777409306631#m" title="Jul 2, 2021 · 7:35 AM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">We’ve seen only one victim located in Hong Kong in our telemetry. The operators must have added another currently unknown way to compromise devices since <a href="/360Netlab" title="360 Netlab">@360Netlab</a> originally mentioned only exploitation of IOT devices and the victim didn’t use one 7/8</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 4</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 7</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/ESETresearch/status/1410864779229548546#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ESETresearch"><img class="avatar round" src="/pic/profile_images%2F1244546916106612736%2FsvU0TBgH_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ESETresearch" title="ESET research">ESET research</a>
                        <a class="username" href="/ESETresearch" title="@ESETresearch">@ESETresearch</a>
                      </div>
                      <span class="tweet-date"><a href="/ESETresearch/status/1410864779229548546#m" title="Jul 2, 2021 · 7:35 AM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">IoCs: rec.micosoft[.]ga 45.67.230[.]53 e5e6e100876e652189e7d25ffcf06de959093433 fa6a40d3fc5cd4d975a01e298179a0b36aa02d4e <a href="/search?q=%23ESETresearch">#ESETresearch</a> 8/8</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 3</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 13</div></span>
                </div>
              </div>
            </div>
          </div>
        </div>
        <div id="r" class="replies">
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/Sebdraven/status/1411015424959975427#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/Sebdraven"><img class="avatar round" src="/pic/profile_images%2F1420125076779900933%2FcOc3kbDk_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/Sebdraven" title="Sebdraven">Sebdraven</a>
                        <a class="username" href="/Sebdraven" title="@Sebdraven">@Sebdraven</a>
                      </div>
                      <span class="tweet-date"><a href="/Sebdraven/status/1411015424959975427#m" title="Jul 2, 2021 · 5:34 PM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/ESETresearch">@ESETresearch</a> <a href="/HrckaVladislav">@HrckaVladislav</a></div>
                <div class="tweet-content media-body" dir="auto">Nice catch bro ! 👌</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 3</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/HrckaVladislav/status/1411033264702341127#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/HrckaVladislav"><img class="avatar round" src="/pic/profile_images%2F1241444086676172800%2FzapHYvZT_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/HrckaVladislav" title="Vladislav Hrcka">Vladislav Hrcka</a>
                        <a class="username" href="/HrckaVladislav" title="@HrckaVladislav">@HrckaVladislav</a>
                      </div>
                      <span class="tweet-date"><a href="/HrckaVladislav/status/1411033264702341127#m" title="Jul 2, 2021 · 6:45 PM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Thanks!</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 2</div></span>
                </div>
              </div>
            </div>
          </div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/rootdb21/status/1411062943719038982#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/rootdb21"><img class="avatar round" src="/pic/profile_images%2F1483471901225803776%2FkKSwzQir_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/rootdb21" title="Wess">Wess</a>
                        <a class="username" href="/rootdb21" title="@rootdb21">@rootdb21</a>
                      </div>
                      <span class="tweet-date"><a href="/rootdb21/status/1411062943719038982#m" title="Jul 2, 2021 · 8:43 PM UTC">2 Jul 2021</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/ESETresearch">@ESETresearch</a> <a href="/HrckaVladislav">@HrckaVladislav</a></div>
                <div class="tweet-content media-body" dir="auto"><a href="https://meltdownattack.com/">meltdownattack.com/</a></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div></div>
        </div>
        <div class="top-ref"><div class="icon-container"><a class="icon-down" title="" href="#m"></a></div></div>
      </div></div>
  </body>
</html>